Exception when validating the signature of the assertion

[Yaowen Tu]

Thanks for you answers Brent and Scott.

Can I dig one more step further? I don't really understand how step c is
done. To me in order to finish step c, we need the string of the whole
assertion, otherwise we won't be able to construct the digest value. Is the
string part of the Signature object stored in some private field? Can you
point out which field? or which part of the code do this?


Yaowen


On Tue, Nov 6, 2012 at 2:54 PM, Brent Putman <putmanb at georgetown.edu> wrote:

>
> On 11/6/12 5:47 PM, Yaowen Tu wrote:
> > Scott maybe I should have asked it in another way:
> >
> > When SP tries to validate the signature, theoretically it needs to:
> >         a. make sure the certificate of IdP really belongs to the IdP.
> > This is done by trust engine.
>
> Yes, by either our TrustEngine/SignaureTrustEngine, or a some other code
> that performs the same function.
>
>
> >         b. make sure the signature is generated by the private key of
> > the certificate by decrypting it using the public key in the certificate
> >         c. make sure the message is not modified by comparing the
> > digest value of the assertion and decrypted signature.
>
>
> b and c are both part of what I could call cryptographic operation of
> XML Signature verification, they aren't really separate steps, at least
> from a high-level.  If you were implmenting a low-level XML Signature
> library, then yes, these would be separate steps in the process.
>
>
>
>
> >
> > I know the method doesn't do step a, but how about step b and c? I
> > think the method will do step b, since it accepts signature and
> > credential as the parameters. What I really want to know if how step c
> > is achieved?
>
> Both b and c are handled by the OpenSAML SignatureValidator via the
> underlying signature library we use (Apache Santuario/xmlsec), so you
> don't have to do anything there.  If the Signature validates with the
> Credential you pass in, then both b and c have been evaluated successfully.
>
> --
> To unsubscribe from this list send an email to
> dev-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20121106/3ce6ffa8/attachment.html